czdev: publish/unpublish via Release manifests (no Git LFS)#4
Merged
Conversation
The packages repo no longer stores .deb in git/LFS (LFS budget exhausted). Adapt the publish flow to the new manifest model: - publish: upload the .deb to a "czdev-buffer" Release on the push target (the contributor's own fork for non-maintainers — their free Release quota), then open a PR carrying only meta.json/screenshots/icon and a <pkg>_<ver>_<arch>.deb.release.json manifest (url + sha256 + size). No .deb, no LFS. Raises the size cap to the 2 GiB release-asset limit. - unpublish: read the manifest, download the .deb from its url to verify the Maintainer, and remove the manifest from git. - github_client: add ensure_release / upload_release_asset / find/delete asset. - Drop the git-lfs requirement. Co-authored-by: Cursor <cursoragent@cursor.com>
1 task
czdev was rewritten from Rust to Python and the crates/czdev Rust crate was removed, so 'cargo run -p czdev' (and the crates/czdev path filter) no longer resolve — this workflow has failed on every main push and PR since then. Remove it; the Python czdev has no Rust/emulator smoke harness. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CardputerZero/packagesis moving.debdistribution off Git LFS (the org LFS budget is exhausted and hard-blocks pushes). See CardputerZero/packages#51.czdevmust stop pushing.debinto the PR via LFS.New flow
For any third-party developer (normal GitHub login, no write access to the packages repo):
czdev publishuploads the.debas an asset on aczdev-bufferRelease in the developer's own fork ofpackages. This uses the developer's free Release storage + unlimited download bandwidth — the upstream project stores nothing until approval.meta.json, screenshots/icon, and a<pkg>_<ver>_<arch>.deb.release.jsonmanifest (url+sha256+size). No.deb, no LFS.dpkgchecks (untrustedpull_requeststage). On merge it promotes the binary from the fork release into the officialapt-poolrelease.Maintainers (write access) upload to the buffer release on the official repo; the promote step is identical.
Changes
publish.py: upload.debto the buffer release + emit manifest; commit metadata only; size cap raised to the 2 GiB release-asset limit; drop git-lfs requirement.unpublish.py: read the manifest, download the.debfrom its URL to verify Maintainer, remove the manifest.github_client.py:ensure_release,upload_release_asset,find_release_asset,delete_release_asset.Notes
~is sanitized to.in release asset names; manifestfilenameaccounts for this.Test plan
czdev publishfrom a non-maintainer account → buffer release created in the fork, PR has manifest only.czdev publishfrom a maintainer → buffer release on the official repo.czdev unpublish→ ownership verified via manifest URL, manifest removed.Made with Cursor